BaFin’s 2027 Rulebook Forces CFD Firms to Restructure

TL;DR: BaFin’s WpI MaRisk circular replaces bank-focused risk standards for small and mid-sized German investment firms starting January 1, 2027. CFD dealers that hold client money cannot qualify for the small-firm classification and will face medium-firm controls, including daily trading-book valuations, multi-year capital plans with adverse scenarios, and formal wind-down cost assessments. Operators with BaFin-licensed entities have four months to close the gap.

What the WpI MaRisk Circular Actually Is

Germany’s Federal Financial Supervisory Authority (BaFin) published the WpI MaRisk circular in August 2026. It creates a dedicated risk-management framework for smaller investment firms that until now have been applying standards written for banks. The trigger is the EU’s Investment Firms Directive and Investment Firms Regulation — the IFD/IFR package — which created two non-bank firm categories: small and non-interconnected (SNI) and medium. The new circular maps German supervisory expectations onto those categories, replacing the awkward analogy to bank MaRisk that had governed these firms. Large investment firms that qualify as systemically significant remain under full bank capital rules after January 1. Every other BaFin-supervised investment firm moves to the new regime.

The practical scope for the retail trading industry: any German entity that executes client orders, deals in derivatives, or holds client money is within the perimeter. Brokers licensed as full credit institutions stay on bank standards. For most CFD and FX groups operating a dedicated German investment-firm subsidiary, the new framework applies directly. A compliance and operational audit run now — before year-end — is the fastest way to identify where gaps exist.

Why CFD Dealers Are Locked Out of the Small-Firm Category

The SNI classification under EU Investment Firms Regulation Article 12 is cumulative. Every single condition must be satisfied simultaneously. Two of those conditions are disqualifying for almost every retail CFD operator: client money held must be zero, and safeguarded client assets must be zero. Measures tied to trading flow and own-account market risk must also be zero.

A CFD dealer that holds margin deposits — which is every standard retail broker model — fails the test immediately. It lands in the medium-firm category by default, unless it clears the higher bar that pushes systemically important firms back under bank rules. Medium-firm status brings a materially heavier operational burden. Groups running forex acquisition campaigns at scale in Germany need to understand that the compliance infrastructure required to support that business just got more demanding, not less.

The Risk Map: Customer Harm and Platform Outages Are Now Explicit

One of the most operationally significant changes is BaFin’s explicit enumeration of customer-risk categories. Covered firms must identify and manage risks including unsuitable investment advice, failed control procedures, trading and valuation errors, actions by tied agents, and — critically — system and process outages. ICT risk must be included in the overall risk identification process, not treated as an IT department matter separate from regulatory risk.

Platform downtime is now a supervisory risk category, not just a customer-service problem. Any operator running a white-label or third-party platform under a BaFin license needs a formal assessment of what happens when that platform goes offline during a volatile market event. Firms that do not segregate client money must also specifically account for that structure inside their customer-risk framework. ESG factors are treated as potential drivers of other risks — they don’t require a standalone ESG risk function, but they can’t be ignored entirely.

For operators scaling paid media programs to grow German retail books, the practical implication is that growth plans should be modeled alongside compliance capacity, not after it. Regulatory pressure on client-harm risks makes the cost of poor lead quality — clients who churn rapidly or generate complaints — higher than it has ever been.

Daily Trading-Book Controls and Capital Planning Requirements

Medium firms face a set of structured controls on their trading books that go beyond general risk awareness. Positions must be monitored continuously. Discrepancies must be investigated promptly and recorded in risk systems without delay. When losses from positions are material, firms must maintain counterparty, issuer, and market-price risk limits, track their use in real time, and document every breach and the remedial steps taken.

Trading-book positions must be valued daily and combined into a single overall risk position at least once per day. Investment-book positions carrying market-price risk require quarterly valuation at minimum, with more frequent checks where the activity level warrants. These are operational infrastructure requirements, not policy commitments. Firms need systems capable of producing these outputs on schedule.

Capital planning requirements are equally concrete. Every covered small and medium firm must prepare a multi-year capital plan linked to its actual operations and risk management framework. The plan must include an expected case and at least one adverse scenario — a stress test built into the planning cycle, not a one-time regulatory exercise. Medium firms must also estimate the duration and cost of an orderly wind-down. That estimate must be more detailed where the firm holds customer cash or securities. Wind-down planning has always been a regulatory expectation in principle; under WpI MaRisk it becomes a documented deliverable. Operators who run high-frequency acquisition models in other regulated verticals will recognize this pattern: regulators want to see that growth is matched by operational durability.

Outsourcing and Compliance Function Requirements

Every covered firm must have a compliance function. A separate risk-management function and internal audit are required where proportionate to size and complexity — for most medium-category CFD firms, that means all three functions are mandatory. The rules make outsourcing arrangements a supervised area in their own right. All outsourcing must sit inside a central management framework. Firms need a complete register of outsourced services, ongoing service-quality reviews, and controls that extend into subcontracting chains — not just the first-tier provider.

This matters for technology and marketing infrastructure. A firm using an outsourced CRM, a third-party lead-qualification layer, or AI-powered lead qualification tools connected to its onboarding flow needs that arrangement documented in its outsourcing register. The subcontracting chain requirement means that if the CRM provider uses a sub-processor for data handling, that relationship is also within scope. Operators should verify now whether their outsourcing register — if they have one — reflects current arrangements and covers third parties that touch client data or trading infrastructure.

What This Means for Forex and CFD Operators

The WpI MaRisk framework is the most consequential change to German investment-firm supervision in the retail FX and CFD space since leverage restrictions arrived under ESMA’s product intervention rules. It does not cap leverage or restrict products. It does require the operational and compliance infrastructure to match the business model — and for most medium-category CFD firms, the current baseline inherited from bank MaRisk was not built for this.

Firms with German entities should run a gap assessment against the new requirements before Q4 planning locks in budgets. The areas most likely to require investment: risk system capability for daily position reporting, outsourcing register completeness, capital plan documentation including the adverse scenario, and formal wind-down cost modeling. Operators building precision audience programs for German retail acquisition should factor increased compliance overhead into client economics — a higher compliance cost base changes the CAC threshold at which German retail acquisition is profitable.

Groups that have not mapped their German entity’s classification under IFR Article 12 should do that first. The SNI test is binary: either every condition is met or the firm is medium by default. For CFD dealers holding client margin, the outcome is almost always medium. Crypto-adjacent operators with German MiFID licenses serving retail derivative clients face the same classification analysis. The January 1, 2027 deadline is fixed. The transition window to act is now.

Originally reported by Finance Magnates Forex, August 2026.